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Credit underwriting 
after the crisis 


Prior to the recent financial crisis, numerous banks revamped their credit underwriting processes with a focus 
on speed, costs, efficiency, and customer satisfaction. The one thing they forgot to consider was effectiveness, 
or risk cost, and many subsequently got burned. Several banks are again re-evaluating their credit processes, 
now with an emphasis on lower losses and streamlined operations. By focusing jointly on efficiency and 
effectiveness, banks can draw important lessons from the crisis and accordingly adapt to the new dynamics of 
credit demand and supply. This document outlines the key structural trends that are reshaping banks’ credit 
underwriting processes and discusses practical measures banks should take to extract significantly higher 
value from lending operations. 


THE NEW DYNAMICS OF CREDIT UNDERWRITING 


Believe it or not, some financial market essentials have been stable throughout the crisis. Credit is, and will 
remain, the core financing source for companies and private individuals. It will also remain a core driver of 
bank revenues and profits for the foreseeable future. Assuming relatively competitive markets and informed 
customers, credit economics will continue to be driven primarily by three dimensions of the credit underwriting 
process: efficiency (operational cost) and effectiveness (risk cost) in combination with pricing (revenues). 


Despite these elements of continuity, the credit business has changed dramatically and will in all likelinood not 
revert to pre-crisis norms for quite a while, and for good reason. We expect that higher demand for bank credit 
and weaker supply will continue to define and shape the “new normal” of the credit business. 


As the economic recovery continues, demand for credit will rise as corporates pursue investments suspended 
during the crisis. These projects will be funded mainly through banks, as capital markets’ appetite for this type 
of risk is much lower than in the previous decade. At the same time, the ongoing repercussions of the crisis 

will generate a wave of risk-related loan prolongations, and banks will need to evaluate these requests against 

a significant drop in the credit quality of borrowers. On the credit supply side, banks will bear higher costs for 
balance sheet usage, as both capital and funding (especially long-term) will be scarcer and more expensive 
resources in a stricter regulatory framework. In addition to this reduction in credit supply, secondary markets will 
have less capacity to absorb risk from banks. 


FIVE STRATEGIC AREAS OF PROCESS REDESIGN 


The new dynamics bear significant implications for practically every bank and call for the redesign of the credit 
underwriting process in alignment with the “new normal.” Broadly speaking, this realignment would address five 
fundamental areas: 


1) Start with a clear risk strategy 

2) Make risk assessment a balance of hindsight and foresight 

3) Strengthen an end-to-end risk mindset, from sales to processing 
4) Boost effectiveness through improvements in efficiency 


5) Shape a new organizational risk culture 


As discussed at the end of this article, the benefits of process redesign are significant. Well targeted 
interventions in each of these areas can strengthen banks’ credit underwriting processes, resulting not only in 


improved risk assessment but in reduced operating costs and increased capacity for new lending activity as 
well. In order to achieve these gains, information technology (IT) and operations should work jointly to ensure 
that the underlying infrastructure fully supports the new process throughout the entire organization. In many 
cases, IT can enhance functionality in ways that lead to new business opportunities. Post-crisis redesign of 
credit underwriting as well as other risk management processes provides an excellent opportunity for banks 
to conduct an end-to-end review of existing IT systems and consider major upgrades, or even replacement, to 
increase significantly the impact of the process changes. 


Start with a clear risk strategy 


Before setting out to strengthen the credit underwriting process, any bank must first understand its own 

risk appetite and operationalize its risk-taking behavior in arisk strategy. Risk appetite is the level of risk an 
organization expects to take in the course of normal business operations. Ideally, an institution's risk rating is an 
accurate measure of its risk appetite, which can also be described as the risk-taking preferences (or tolerances) 
of the bank’s equity and debt investors. 


The bank’s total risk appetite is reflected in its “lines of defense,” which comprise business strategy, operational 
capacity, and risk strategy. Business strategy defines the intrinsic risk-return characteristics of the respective 
business units. Operational lines of defense include organizational skill, Knowledge, and processes such as 
origination, structuring, and restructuring. Finally, the routine “lines of defense” of the business units are limited 
by the bank’s “last line of defense” - its ability to absorb losses in different economic scenarios, as defined in 
the risk strategy. The risk strategy may be a 3-year plan with performance goals that fall within a framework of 
risk targets for different economic scenarios. To be effective, the risk strategy should be developed through 
collaboration among the business units, the CFO, and the CRO. While the CFO is responsible for financial 
goals and target risk rating, the CRO controls risk appetite by evaluating the effectiveness of the bank’s “lines of 
defense” against excessive or extreme risks. 


To operationalize the risk strategy and take the portfolio “on stream,” the front office and risk function should 
break down overall limits into limits for business units and even further limits for specific segments. In 

addition to risk, return, and growth expectations, banks should consider core limiting factors such as capital, 
concentration, funding, and leverage in establishing sub-portfolio limits. Within specific segments or business 
units, the front office and risk function should develop detailed “credit standards” for application at the customer 
and (when possible) deal level. This approach allows the bank to define upfront basic parameters for risk 
decisions. The parameters may include industry sector limits, counterparty rating limits, and loan-to-value (LTV) 
limits. By working together to define portfolio limits and credit standards, the front office and risk function (with a 
right of veto) can reconcile their fundamentally different outlooks on risk, opportunity, and evaluative procedures 
to reflect the bank’s overall policy on risk-taking (Exhibit 1, page 3). 


Make risk assessment a balance of hindsight and foresight 


Risk assessment has so far been overly reliant on hindsight (retrospective analysis). Most tools seek to reduce 
complexity through statistical analysis of historical data, such as annual reports or evaluations by rating 
agencies and credit bureaus (e.g., Fair Isaac, Experian, Dun & Bradstreet). But in addition to these historical 

or retrospective analyses, risk assessment should also incorporate forward-looking assessments based ona 
combination of public and confidential documents (such as business cases and the borrower’s strategic plans) 
and the analyst’s individual expertise and experience (knowledge of a company and its executives, familiarity 
with the industry, previous market experience). Risk assessment models, in other words, need systematically 
and consistently to apply individual, subjective judgments, which have been formed over the career of the 
analyst. 
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Exhibit 1 
Operationalize the target portfolio through a 3-step hierarchical breakdown 
from portfolio to deal level 
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The introduction of forward-looking parameters will most certainly not make risk assessment easier, but we 
believe the combination of hindsight and foresight is essential for a thorough understanding of the potential root 
causes of strategic, operational, and financial difficulties in banks’ portfolios. 


To strike the right balance between historical and forward-looking analysis, banks will have to establish a new 
“pact” between rating engines and human insight. Automated rating processes should, for example, highlight 
factors contributing to risk such as internal indices of a borrower’s poor credit management and credit bureau 
issues. Human decision makers, by contrast, can more effectively focus on the signs of future risk, forming links 
and relationships among disparate details, and capturing the nuances that are the blind spots of automated 
analysis. For instance, a relationship manager and/or credit analyst might weigh relevant news items such as a 
new investor entering with equity ownership, a strong trend of market concentration, or robust revenue flow from 
aspecific industry sector (Exhibit 2, page 4). 


Among the alternative approaches for implementing forward-looking risk assessment, two methods are most 
successful: the integration of forward-looking quantitative analysis (with statistically established metrics) into the 
existing rating model, or the running of two separate analyses, one historical, the other prospective. 


In the first approach, the existing rating model incorporates a quantitative forward-looking component 
supported by statistical analysis. The financial analyst tries to quantify forward-looking rating variables (e.g., 
future balance sheet ratios) directly in the rating engine using a structured “soft information hardening” model. 
Such amodel advances the analyst to the “hard” estimate of future ratios through a path of qualitative, “soft” 
questions. These assumptions are then validated against preset benchmarks (e.g., industry outlook) leading to 
a forward-looking quantification of the probability of default (PD). If historical and forward-looking evaluations 


differ, the analyst has to explain the difference. Of course, for retail portfolios, the process must be much leaner 
and faster, using automated sub-portfolio assessments, for instance by geography, age, profession, or income. 


Exhibit 2 
Credit analyst valuation can drive a new pact with automated 
rating engines 
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In the second, a free-standing forward-looking assessment model operates side by side with the existing 

rating model, leveraging the possibility of adjusting the historic rating by the forward-looking evaluation. The 
adjustment is performed through a structured questionnaire to be completed by the analyst and incorporates 
analysis of all rating components such as leverage, liquidity, profitability, and efficiency. The analyst must explain 
the difference between the historic and forward-looking ratings and evaluate them against each other. 


Strengthen an end-to-end risk mindset, from sales to processing 


Who is best qualified to lead risk assessment, the market-facing sales group or specialists in an independent 
risk office? The question is a subject of frequent and lively debate, particularly among wholesale bankers. The 
market-led model has obvious advantages: higher customer satisfaction based on better product capabilities 
and customization, higher predictability of credit decisions, and full accountability for both risk and revenue in 
the front office. But the risk-led model has distinct advantages as well: a higher degree of independence from 
market expectations and higher potential for process differentiation by type and complexity of deal (by achieving 
critical mass in a centralized risk function). We believe that the merits of a separate risk function should be 
revisited in light of the crisis, but ultimately the right balance between market-led and risk-led analysis depends 
on each financial institution’s strategy — the types of market it serves, its customer communication and marketing 
strategy (e.g., mass market versus high touch), its strategy for future growth, its appetite for risk, and so on. 
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In general, banks should strengthen communication and partnership among the diverse teams and disciplines 
that steer a loan or credit instrument through the pipeline. To do this successfully, banks need to define an end- 
to-end risk process spanning the front and back offices and consisting of incentives, competency standards, 
certification, and individual accountability. 


The front office and risk function should be encouraged to de-risk with incentives. Risk indicators such as 
adherence to risk cost “corridors” and collaboration between the front office and risk function provide a 
transparent qualitative basis for rewarding cross-functional teams for hitting risk targets. Performance bonuses 
should also contain long-term components, retaining a portion of bonuses for later payment to reflect the degree 
of accuracy in risk assessments over time. 


As important as incentives is the transparency of standards used to define the limit of an individual’s authority 
to make credit decisions. Thresholds for each level of credit authority (or “competency”) should be intuitively 
logical, quantitatively measurable, and consistently predictable (i.e., non-volatile). Economic capital figures, 

for example, seem to be a poor measure for evaluating credit-decisioning competency, because they are too 
volatile and vulnerable to manipulation. Total exposure, rating, asset type (Secured versus unsecured), and 
risk-weights are more stable parameters and suitable for the establishment of clear and pragmatic competence 
levels. 


In order to ensure that only qualified people make credit decisions, banks should also establish a credit 
underwriting “driver’s license.” This is a way to recognize competency in addition to seniority. The skill of 

credit underwriting is part experience (seniority), part knowledge and part talent, so “credit authority,” or one’s 
authority to make credit decisions, should be based not on seniority alone but should reflect all dimensions 

of underwriting skill. Potential decision makers can increase their license level, for instance, according to the 
number of decisions they made in the past, the quality of the portfolio they underwrote through the cycle, or 

the risk training and capability-building programs they attended. The license level can be used both to assign 
decision-making competencies and to monitor performance and create incentives. Promotion to a senior credit 
executive role would, for instance, require the highest license level. 


In developing the credit driver's license, coordination among the risk, operations and IT groups can simplify 
procedures for routing origination documents by assigning access rights more dynamically and not simply on 
the basis of hierarchy (Seniority) to qualified officers. 


The final step in building an end-to-end risk mindset is to strengthen individual accountability. Credit 
committees are common and in some cases appropriate, but they can actually weaken the quality of credit 
decisions. Evidence reveals the danger of socializing responsibility, where individuals involved in decisions 
requiring review and signoff by large numbers at varying levels feel diminished responsibility for their own 
personal evaluation and judgment. Consequently, credit competence structures, as explained above, should 
be aimed at assigning a credit decision directly to an appropriately qualified individual or, when necessary, a 
committee with a limited number of members. This reduces the number of people and committees involved in a 
single decision, thus increasing the personal accountability of the actual decision makers. Furthermore, credit 
competence structures should ensure that decision makers invest sufficient time in their individual analysis and 
decision making (i.e., avoid decision overloading). 


However, credit committees can play an important role in the credit process: they can strengthen the risk 

culture by establishing a platform for discussing complex cases, which facilitates the emergence of acommon 
understanding across business units and hierarchical levels. This cross-functional alignment in turn strengthens 
credit standards going forward. 


Boost effectiveness through improvements in efficiency 


Speed and cost will remain important considerations in the redesign of the underwriting process, and in the 
wake of the crisis, efficiency has become a primary objective as a better foundation for strategically appropriate 
risk decisions. To be perfectly clear, there is no trade-off between efficiency and effectiveness. To the contrary, 
improvements in efficiency lead to fewer mistakes and misunderstandings, more stability in the underwriting 
process and, ultimately, increased effectiveness in risk decisions. Banks can boost both efficiency and 
effectiveness by standardizing processes, differentiating underwriting work according to complexity, and 
streamlining to eliminate waste. 


Banks should aim for consistency in decisions across teams, geographies, etc. Standardizing and reducing 
variability in the underwriting process increase process efficiency and the quality of the risk decision. They also 
facilitate the sharing of best practices, training, coaching, and good team management. Credit standards are 
an important starting point in standardizing the actual risk assessment, which is at the heart of underwriting. The 
sales function’s loan application memo and the credit vote should be structured within these standards in order 
to save time otherwise lost in preparing, reading, and discussing the applications. The sales and risk functions 
can then focus on the same standard risk categories agreed upon upfront so that risk decisions can be geared 
to the truly important elements of deals. 


Asignificant driver of efficiency is the differentiation of deals according to risk profile and underwriting 
complexity, and their routing along separate processing tracks. Large, complex, risky deals require more 
attention and time than small, low-risk deals. In most cases, banks can speed up the underwriting process 

by clustering deals into specific categories, defined, for example, by riskiness, complexity, and exposure 

size. Basic underwriting parameters should be established according to each category’s risk profile. Process 
differentiation works equally well for the wholesale and retail businesses. In the wholesale business, the 

time freed up can be used to extend the scope of quantitative analysis of historical performance (of individual 
companies) and forward-looking trend analysis (of market segments or industry sectors) for more complex 
deals. Due to the comparatively poor quality of data on financials for small and medium-size enterprises (SMEs), 
quantitative analysis in this client segment can be complemented by deeper qualitative research, particularly for 
deals in the high-risk segment (Exhibit 3, page 7). 


Best-practice banks mirror these process changes in the supporting IT platform in order to increase efficiency 

as wellas to limit the “human factor.” Routing mechanisms based on complex multi-parameter algorithms 

are complemented with electronic exception management and approval functionality. In addition, increased 
automation enables convenient on-line reporting and monitoring of multiple key performance indicators (e.Q., 
productivity, speed of response, acceptance rate). This is a significant intervention requiring the joint participation 
of the IT, business, and risk functions in order to sustain a successful process redesign over the long term. 


After differentiating underwriting work by complexity, risk, etc., banks should next streamline the risk 
assessment process by eliminating waste in each variant or segment. There should be a clear separation 
between administrative and risk-related work, and streamlining IT (reducing interfaces and data) can significantly 
improve process efficiency. 


Waste is common in the credit pipeline. Some deals ultimately fail only after spending significant time in the 
pipeline before the final cancellation decision. Closer collaboration between sales and risk through simple 
pre-rating tools and knockout filters can accelerate “no-go” decisions. Such tools, in combination with pipeline 
meetings and upfront deal reviews involving short one-page deal memos, not only save significant time by 
promptly eliminating deals not in line with the bank’s strategy, but they also enhance risk selection by fostering 
discussion, alignment, and a joint culture. 
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Exhibit 3 
Enhance credit process effectiveness through increased efficiency for 
standard cases and more extensive analyses for complex cases 
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1 For example: use of internal database and models instead of case-by-case property assessment for smaller 
real estate assets 


A further important aspect for streamlining processes is the principle of “first time right.” In our experience 
significant inefficiencies result from one employee having to work on the same case multiple times. For example, 
people in the legal department may start reviewing a deal, reading through all the material, and completing three- 
quarters of the case only to discover that the front office has omitted relevant information. The case is returned to 
sales and lands back on the legal desk some days later. At best, the same employee resumes his review but will 
surely have to reread major parts, having dealt with numerous other cases in the meantime. Getting it right the 
first time, not surprisingly, is an easy task if processes and documents are standardized. 


Shape a new organizational risk culture 


During the crisis, even well-refined models and data did not prevent collective failures. Now, most organizations 
are more often than not focused on improving existing risk management systems and models rather than on 
tackling the underlying culture, the mindsets, and behaviors. To cut the distinctive edge and bring about a 
fundamental and lasting change in the credit business requires a new understanding of organizational risk 
culture. McKinsey & Company has worked extensively to establish a comprehensive, rigorous definition of risk 
culture and developed a distinctive method for analyzing and strengthening an organization’s collective mindset 
and behavior in risk-taking.’ Close evaluation of behaviors and attitudes can reveal outdated mindsets that 
compromise the effectiveness of the underwriting process. Our research has identified a limited number of key 
factors ranging from communication and cooperation to openness to challenge and speed of responsiveness. 
Together, the factors represent an organization’s respect for and tolerance of risk. By diagnosing weaknesses 


1 For more this topic see Cindy Levy, Eric Lamarre, and James Twining, “Taking control of organizational risk culture,” 
McKinsey Working Papers on Risk 16 (February 2010). 


in individuals’ perception and performance of duties, a bank can chart a course to transform the mindset and 
align the organization’s risk culture with its strategic appetite for risk. To accomplish this change, executive 
management must engage the organization and launch it on a journey. 


Benefits of process redesign 


Banks that stay focused on the combined goals of efficiency and effectiveness can capture significant value 
from a restructured credit underwriting process. Efficiency improvements often reduce approval times by at 
least 30 percent and increase productivity by up to 30 percent, freeing up resources for more sophisticated 
risk assessment, new sales, customer service, and process improvements in other operational areas. Gains 
in effectiveness include reductions in risk cost by as much as 50 percent, increases in risk-adjusted return and 
higher standing with external stakeholders (e.g., auditors, rating agencies, and shareholders; see Exhibit 4). 


Exhibit 4 
The cost and performance benefits of process redesign are significant 


Increase 
quality and 


effectiveness 
Quality and effectiveness 


Decrease expected risk e 
costs by up to 50%! 


Increase 
efficiency 
("lean") 


Increase in risk- O 
adjusted return 


Higher standing with 
external stakeholders o 


(auditors, rating 


agencies, etc.) 


O e O Key success factors 
Decrease Decrease Decrease " Fast diagnosis with proven 
front-office back-office time-to- approach 
cost cost market = Broad involvement from risk 

-10% -20% -30% and sales 
= Phased implementation with 
Efficiency extensive piloting and early 


quick-win rollout 
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MAPPING THE NEWPROCESS 


But how to reap the gains of process redesign? It's one thing to describe the components of a highly efficient 
and successful risk process, but another to instill each individual, team, and business unit with a new set of 
standards and practices reflecting an organization's risk appetite and business strategy. 


In order to lay the foundation for a new, more robust risk culture, the redesign of the credit underwriting process 
should follow a path determined by the specific situation, needs, and aspirations of a given organization. The 


Credit underwriting after the crisis 


measures outlined in this article can improve performance across the full soectrum of a bank’s credit services, 
including corporate lending, asset-backed finance, small business, and retail lending. These efforts should be 
coordinated across all business lines. 


Key factors for success 


Banks should first engage representatives from across the organization, forming a multidisciplinary project 
team with participants from sales, branches, risk management, and loan processing. The full journey typically 
requires 4 to 5 months and ideally begins with a 1-day credit walkthrough to survey the credit underwriting 
landscape. This enables the project team to shape hypotheses about specific areas of improvement and gain 
insight into the type and potential magnitude of improvements to be realized. On the basis of this initial review the 
team should establish three areas of agreement: 


1) Identify the levers of value. The review team should determine early on the levers that will add value to 
the risk process (either through efficiency or effectiveness) and then prioritize these levers and establish an 
action plan to exercise them. 


2) Buy-in across all stakeholders. Ifthe journey is undertaken in earnest, the redesign will not only 
change the risk process but will also transform the mindset of individuals and hence the risk culture of the 
organization. The project team should conduct interviews, workshops, and other activities to ensure broad 
participation in the development of solutions. 


3) Engage the board of directors for alignment with overall bank strategy. The involvement of both 
the executive board and board of directors is crucial to ensure that decisions are timely and strategically 
appropriate and drive the adoption of solutions across all business units. 


Necessary adjustments and transformation of IT systems and landscape naturally require more time. Many 
banks proceed with a pilot without major IT changes and then plan delivery of the required IT functionality in 
several waves, typically lasting 12 to 24 months. 


The true journey is a path to transformation. By traveling along this path, individuals gain a new understanding 
of their role in forming the organization’s risk culture and driving its performance. We believe that the current 
circumstances present a unique opportunity for banks to engage in such a journey, transform the credit 
organization, and ultimately break free from the “overshoot-undershoot” swing pattern that often follows crises. 
Banks that go the distance in this journey will position their organization to master the next series of challenges 
and gain anew competitive edge that allows them to take full advantage of future growth opportunities. 
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